Spyware I can't seem to get rid of

[Bifta]

I have some malware that's altering my registry at the moment, istsvc, it alters some registry key (see attached) despite me removing it. I run Ad-aware pro with the latest reference file and it detects it, claims to remove it, but if I run another scan straight away, it finds it again, regardless of whether a browser is open or not, I then tried Spybot with the latest updates it didn't even detect it, how do I get rid of it? (it's not picked up by Avast either).

Originally Posted by Bifta

I have some malware that's altering my registry at the moment, istsvc, it alters some registry key (see attached) despite me removing it. I run Ad-aware pro with the latest reference file and it detects it, claims to remove it, but if I run another scan straight away, it finds it again, regardless of whether a browser is open or not, I then tried Spybot with the latest updates it didn't even detect it, how do I get rid of it? (it's not picked up by Avast either).

Its something starting up from the registery.

Run Regedit and check..

Hkey local machine / software / microsoft windows / current version / run

HTH

Edit : It may not be spyware - Adaware pro often false alarms !!

[Ramrod]

What effect does it have when it alters the registry?

[Bifta]

Originally Posted by stuartbe

Its something starting up from the registery.

Run Regedit and check..

Hkey local machine / software / microsoft windows / current version / run

HTH

Edit : It may not be spyware - Adaware pro often false alarms !!

I know that!!! The ad watch thing show's it trying to install the registry key, but I can't find where the remove the program that's actually doing it, it's not under c:/program files/ and it's not hidden either .. very confused

[Bifta]

Originally Posted by Ramrod

What effect does it have when it alters the registry?

It then alters my default homepage to some crappy search engine.

Originally Posted by Bifta

I have some malware that's altering my registry at the moment, istsvc, it alters some registry key (see attached) despite me removing it. I run Ad-aware pro with the latest reference file and it detects it, claims to remove it, but if I run another scan straight away, it finds it again, regardless of whether a browser is open or not, I then tried Spybot with the latest updates it didn't even detect it, how do I get rid of it? (it's not picked up by Avast either).

jv16 power tools is good for removing stuff from the registry - you have to pay for the 'later' versions, though?

[Bifta]

Originally Posted by homealone

jv16 power tools is good for removing stuff from the registry - you have to pay for the 'later' versions, though?

I can delete the registry key through regedt32 but it keeps altering the registry automatically and sticks the key back in

Originally Posted by Bifta

I know that!!! The ad watch thing show's it trying to install the registry key, but I can't find where the remove the program that's actually doing it, it's not under c:/program files/ and it's not hidden either .. very confused

Have you searched for the file name in regedit ?

[Ramrod]

Thought so, this may be of use

[Bifta]

Originally Posted by stuartbe

Have you searched for the file name in regedit ?

I've removed all entries for it, there's something installed that readding the key though.

Originally Posted by Bifta

I can delete the registry key through regedt32 but it keeps altering the registry automatically and sticks the key back in

jv16 has been good for me during an ATI multimedia card install, - I'm biased - but given the rate of £ against the $ ? :pp

Have you searched the hdd for the file.... It may be a driver of some sort that is installing it !

[Bifta]

Originally Posted by homealone

jv16 has been good for me during an ATI multimedia card install, - I'm biased - but given the rate of £ against the $ ? :pp

Ummmm, deleting the registry keys isn't cutting it, they're getting re-added as fast as I can delete them.

Originally Posted by Bifta

Ummmm, deleting the registry keys isn't cutting it, they're getting re-added as fast as I can delete them.

There is allways deltree /y *.* --- No dont do that

[Ramrod]

Have you looked through that link?